Skip to content

Commit c322fdb

Browse files
damienboddamienbod
committed
Updated security headers
1 parent 0dbd91b commit c322fdb

File tree

8 files changed

+39
-74
lines changed

8 files changed

+39
-74
lines changed

‎DeviceFlowWeb/Program.cs

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,20 @@
11
using DeviceFlowWeb;
22
using Microsoft.AspNetCore.Authentication.Cookies;
3+
using NetEscapades.AspNetCore.SecurityHeaders.Infrastructure;
34

45
var builder = WebApplication.CreateBuilder(args);
56

67
var services = builder.Services;
78
var configuration = builder.Configuration;
89
var env = builder.Environment;
910

11+
services.AddSecurityHeaderPolicies()
12+
.SetPolicySelector((PolicySelectorContext ctx) =>
13+
{
14+
return SecurityHeadersDefinitions
15+
.GetHeaderPolicyCollection(env.IsDevelopment());
16+
});
17+
1018
services.AddScoped<DeviceFlowService>();
1119
services.AddHttpClient();
1220
services.Configure<AuthConfigurations>(configuration.GetSection("AuthConfigurations"));
@@ -40,8 +48,7 @@
4048

4149
var app = builder.Build();
4250

43-
app.UseSecurityHeaders(SecurityHeadersDefinitions
44-
.GetHeaderPolicyCollection(env.IsDevelopment()));
51+
app.UseSecurityHeaders();
4552

4653
if (env.IsDevelopment())
4754
{

‎DeviceFlowWeb/SecurityHeadersDefinitions.cs

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -27,23 +27,7 @@ public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev)
2727
// builder.AddCustomDirective("require-trusted-types-for", "'script'");
2828
})
2929
.RemoveServerHeader()
30-
.AddPermissionsPolicy(builder =>
31-
{
32-
builder.AddAccelerometer().None();
33-
builder.AddAutoplay().None();
34-
builder.AddCamera().None();
35-
builder.AddEncryptedMedia().None();
36-
builder.AddFullscreen().All();
37-
builder.AddGeolocation().None();
38-
builder.AddGyroscope().None();
39-
builder.AddMagnetometer().None();
40-
builder.AddMicrophone().None();
41-
builder.AddMidi().None();
42-
builder.AddPayment().None();
43-
builder.AddPictureInPicture().None();
44-
builder.AddSyncXHR().None();
45-
builder.AddUsb().None();
46-
});
30+
.AddPermissionsPolicyWithDefaultSecureDirectives();
4731

4832
if (!isDev)
4933
{

‎StsServerIdentity/HostingExtensions.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
using Fido2NetLib;
44
using Microsoft.AspNetCore.Identity;
55
using Microsoft.EntityFrameworkCore;
6+
using NetEscapades.AspNetCore.SecurityHeaders.Infrastructure;
67
using Serilog;
78
using StsServerIdentity.Data;
89
using StsServerIdentity.Models;
@@ -13,6 +14,13 @@ internal static class HostingExtensions
1314
{
1415
public static WebApplication ConfigureServices(this WebApplicationBuilder builder)
1516
{
17+
builder.Services.AddSecurityHeaderPolicies()
18+
.SetPolicySelector((PolicySelectorContext ctx) =>
19+
{
20+
return SecurityHeadersDefinitions
21+
.GetHeaderPolicyCollection(builder.Environment.IsDevelopment());
22+
});
23+
1624
builder.Services.AddRazorPages();
1725

1826
builder.Services.AddDbContext<ApplicationDbContext>(options =>

‎StsServerIdentity/SecurityHeadersDefinitions.cs

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -30,23 +30,7 @@ public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev)
3030
// builder.AddCustomDirective("require-trusted-types-for", "'script'");
3131
})
3232
.RemoveServerHeader()
33-
.AddPermissionsPolicy(builder =>
34-
{
35-
builder.AddAccelerometer().None();
36-
builder.AddAutoplay().None();
37-
builder.AddCamera().None();
38-
builder.AddEncryptedMedia().None();
39-
builder.AddFullscreen().All();
40-
builder.AddGeolocation().None();
41-
builder.AddGyroscope().None();
42-
builder.AddMagnetometer().None();
43-
builder.AddMicrophone().None();
44-
builder.AddMidi().None();
45-
builder.AddPayment().None();
46-
builder.AddPictureInPicture().None();
47-
builder.AddSyncXHR().None();
48-
builder.AddUsb().None();
49-
});
33+
.AddPermissionsPolicyWithDefaultSecureDirectives();
5034

5135
if (!isDev)
5236
{

‎WebApi/HostingExtensions.cs

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
using Microsoft.IdentityModel.JsonWebTokens;
33
using Microsoft.IdentityModel.Logging;
44
using Microsoft.OpenApi.Models;
5+
using NetEscapades.AspNetCore.SecurityHeaders.Infrastructure;
56
using Serilog;
67

78
namespace WebApi;
@@ -16,6 +17,13 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
1617
var configuration = builder.Configuration;
1718
_env = builder.Environment;
1819

20+
services.AddSecurityHeaderPolicies()
21+
.SetPolicySelector((PolicySelectorContext ctx) =>
22+
{
23+
return SecurityHeadersDefinitions.GetHeaderPolicyCollection(
24+
_env!.IsDevelopment());
25+
});
26+
1927
services.Configure<CookiePolicyOptions>(options =>
2028
{
2129
// This lambda determines whether user consent for non-essential cookies is needed for a given request.
@@ -90,8 +98,7 @@ public static WebApplication ConfigurePipeline(this WebApplication app)
9098

9199
app.UseSerilogRequestLogging();
92100

93-
app.UseSecurityHeaders(SecurityHeadersDefinitions.GetHeaderPolicyCollection(
94-
_env!.IsDevelopment()));
101+
app.UseSecurityHeaders();
95102

96103
if (_env!.IsDevelopment())
97104
{

‎WebApi/SecurityHeadersDefinitions.cs

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -12,23 +12,7 @@ public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev)
1212
.AddCrossOriginOpenerPolicy(builder => builder.SameOrigin())
1313
.AddCrossOriginEmbedderPolicy(builder => builder.RequireCorp())
1414
.AddCrossOriginResourcePolicy(builder => builder.SameOrigin())
15-
.AddPermissionsPolicy(builder =>
16-
{
17-
builder.AddAccelerometer().None();
18-
builder.AddAutoplay().None();
19-
builder.AddCamera().None();
20-
builder.AddEncryptedMedia().None();
21-
builder.AddFullscreen().All();
22-
builder.AddGeolocation().None();
23-
builder.AddGyroscope().None();
24-
builder.AddMagnetometer().None();
25-
builder.AddMicrophone().None();
26-
builder.AddMidi().None();
27-
builder.AddPayment().None();
28-
builder.AddPictureInPicture().None();
29-
builder.AddSyncXHR().None();
30-
builder.AddUsb().None();
31-
});
15+
.AddPermissionsPolicyWithDefaultSecureDirectives();
3216

3317
AddCspHstsDefinitions(isDev, policy);
3418

‎WebHybridFlowClient/HostingExtensions.cs

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
33
using Microsoft.IdentityModel.JsonWebTokens;
44
using Microsoft.IdentityModel.Logging;
5+
using NetEscapades.AspNetCore.SecurityHeaders.Infrastructure;
56
using Serilog;
67

78
namespace WebHybridClient;
@@ -16,6 +17,13 @@ public static WebApplication ConfigureServices(this WebApplicationBuilder builde
1617
var configuration = builder.Configuration;
1718
_env = builder.Environment;
1819

20+
services.AddSecurityHeaderPolicies()
21+
.SetPolicySelector((PolicySelectorContext ctx) =>
22+
{
23+
return SecurityHeadersDefinitions
24+
.GetHeaderPolicyCollection(_env!.IsDevelopment());
25+
});
26+
1927
services.AddTransient<ApiService>();
2028
services.AddSingleton<ApiTokenInMemoryClient>();
2129
services.AddSingleton<ApiTokenCacheClient>();
@@ -62,8 +70,7 @@ public static WebApplication ConfigurePipeline(this WebApplication app)
6270

6371
app.UseSerilogRequestLogging();
6472

65-
app.UseSecurityHeaders(
66-
SecurityHeadersDefinitions.GetHeaderPolicyCollection(_env!.IsDevelopment()));
73+
app.UseSecurityHeaders();
6774

6875
if (_env!.IsDevelopment())
6976
{

‎WebHybridFlowClient/SecurityHeadersDefinitions.cs

Lines changed: 1 addition & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -27,23 +27,7 @@ public static HeaderPolicyCollection GetHeaderPolicyCollection(bool isDev)
2727
// builder.AddCustomDirective("require-trusted-types-for", "'script'");
2828
})
2929
.RemoveServerHeader()
30-
.AddPermissionsPolicy(builder =>
31-
{
32-
builder.AddAccelerometer().None();
33-
builder.AddAutoplay().None();
34-
builder.AddCamera().None();
35-
builder.AddEncryptedMedia().None();
36-
builder.AddFullscreen().All();
37-
builder.AddGeolocation().None();
38-
builder.AddGyroscope().None();
39-
builder.AddMagnetometer().None();
40-
builder.AddMicrophone().None();
41-
builder.AddMidi().None();
42-
builder.AddPayment().None();
43-
builder.AddPictureInPicture().None();
44-
builder.AddSyncXHR().None();
45-
builder.AddUsb().None();
46-
});
30+
.AddPermissionsPolicyWithDefaultSecureDirectives();
4731

4832
if (!isDev)
4933
{

0 commit comments

Comments
 (0)